Repository navigation
Improve UI #62
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Improve UI #62
Changes from all commits
1fb0998
74b8d54
d14f7b9
3a06123
7126fdc
fa6a715
fbf3ca0
2ff1b43
c7d50f6
a50ff74
ab40665
7b2d2b9
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,8 +4,8 @@ env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" | ||
|
|
||
| # On every push to main: bump cli/package.json (create-page badge) and | ||
| # prepend an OpenAI-written Keep-a-Changelog section. Commits directly | ||
| # with [changelog][skip ci] so tests and this workflow do not loop. | ||
| # prepend an OpenAI-written Keep-a-Changelog section, then open a PR. | ||
| # (main is protected — direct pushes are rejected.) | ||
|
|
||
| on: | ||
| push: | ||
|
|
@@ -21,40 +21,97 @@ jobs: | |
| name: Update changelog & version | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 10 | ||
| if: ${{ github.event_name == 'workflow_dispatch' || !contains(github.event.head_commit.message, '[changelog]') }} | ||
| # Skip bot merges and pushes that only touched changelog/version files. | ||
| if: > | ||
| github.event_name == 'workflow_dispatch' || | ||
| ( | ||
| !contains(github.event.head_commit.message, '[changelog]') && | ||
| !startsWith(github.event.head_commit.message, 'docs: release v') | ||
| ) | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| # Needed so the bot commit triggers deploy hooks that listen to main. | ||
| token: ${{ secrets.GITHUB_TOKEN }} | ||
| token: ${{ secrets.GH_PAT }} # Uses your custom token to bypass restrictions | ||
|
|
||
| - name: Skip if push is changelog-only | ||
| id: guard | ||
| if: github.event_name == 'push' | ||
| run: | | ||
| BEFORE="${{ github.event.before }}" | ||
| AFTER="${{ github.sha }}" | ||
| if [[ -z "$BEFORE" || "$BEFORE" =~ ^0+$ ]]; then | ||
| echo "skip=false" >> "$GITHUB_OUTPUT" | ||
| exit 0 | ||
| fi | ||
| FILES=$(git diff --name-only "$BEFORE" "$AFTER" || true) | ||
| echo "Changed files:" | ||
| echo "$FILES" | ||
| NON_CHANGELOG=$(echo "$FILES" | grep -vE '^(CHANGELOG\.md|cli/package\.json)$' || true) | ||
| if [[ -z "$NON_CHANGELOG" && -n "$FILES" ]]; then | ||
| echo "Only changelog/version files changed — skipping to avoid a loop." | ||
| echo "skip=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "skip=false" >> "$GITHUB_OUTPUT" | ||
| fi | ||
|
|
||
| - name: Setup Node | ||
| if: steps.guard.outputs.skip != 'true' | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "22" | ||
|
|
||
| - name: Generate changelog + bump version | ||
| id: release | ||
| if: steps.guard.outputs.skip != 'true' | ||
| env: | ||
| OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} | ||
| OPENAI_MODEL: gpt-4o-mini | ||
| BEFORE_SHA: ${{ github.event.before }} | ||
| AFTER_SHA: ${{ github.sha }} | ||
| run: node scripts/update-changelog.mjs | ||
|
|
||
| - name: Commit CHANGELOG.md and cli/package.json | ||
| - name: Open changelog PR | ||
| if: steps.guard.outputs.skip != 'true' | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| VERSION: ${{ steps.release.outputs.version }} | ||
| run: | | ||
| git config user.name "github-actions[bot]" | ||
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | ||
|
|
||
| git add CHANGELOG.md cli/package.json | ||
| if git diff --staged --quiet; then | ||
| echo "No changelog/version changes to commit." | ||
| exit 0 | ||
| fi | ||
| git commit -m "docs: release v${{ steps.release.outputs.version }} [changelog][skip ci]" | ||
| git push | ||
|
|
||
| BRANCH="chore/changelog-v${VERSION}" | ||
| git checkout -B "$BRANCH" | ||
| git commit -m "docs: release v${VERSION} [changelog][skip ci]" | ||
| git push -u origin "$BRANCH" --force | ||
|
Comment on lines
+94
to
+97
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -euo pipefail
ast-grep outline scripts/update-changelog.mjs --items all --type function
rg -n -C 6 'BEFORE_SHA|AFTER_SHA|version|CHANGELOG|git|branch|pull request' \
scripts/update-changelog.mjs .github/workflows/changelog.ymlRepository: Arjun544/flutter_init Length of output: 20290 Preserve accumulated changelog entries in the release PR. When two pushes to Update the existing branch from its current tip, aggregate all commits since the last published version, or use unique branches with aggregated ranges. 🤖 Prompt for AI Agents |
||
|
|
||
| EXISTING=$(gh pr list --head "$BRANCH" --base main --json number --jq '.[0].number // empty') | ||
| if [[ -n "$EXISTING" ]]; then | ||
| echo "PR #$EXISTING already open for $BRANCH" | ||
| PR_URL=$(gh pr view "$EXISTING" --json url --jq .url) | ||
| else | ||
| PR_URL=$(gh pr create --base main --head "$BRANCH" \ | ||
| --title "docs: release v${VERSION} [changelog]" \ | ||
| --body "## Summary | ||
| - Bump product version to **v${VERSION}** (\`cli/package.json\` — shown on \`/create\`) | ||
| - Prepend Keep-a-Changelog entry for this push to \`main\` | ||
|
|
||
| Auto-generated by the Changelog + Version workflow.") | ||
| fi | ||
|
|
||
| echo "PR: $PR_URL" | ||
|
|
||
| # Best-effort auto-merge (needs branch rules that allow the Actions bot). | ||
| gh pr merge "$PR_URL" --squash --auto --delete-branch || \ | ||
| echo "Auto-merge not enabled or not permitted — merge the PR manually." | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🛡️ Detected with Advanced Tier | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: Arjun544/flutter_init
Length of output: 17748
Sensitive Data Exposure
Reachability: External
Exploitability: Moderate
CWE: CWE-522 — Insufficiently Protected Credentials
Do not persist
GH_PATin the checkout.actions/checkoutpersists the token in.git/configby default. The laternode scripts/update-changelog.mjsstep runs repository-controlled code in the same checkout. If untrusted code reachesmain, it can read and exfiltrateGH_PAT, then use its granted permissions to push the release branch.Set
persist-credentials: false. Authenticate only the explicitgit pushwith a least-privilege credential.🧰 Tools
🪛 zizmor (1.30.0)
[warning] 36-40: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Source: Linters/SAST tools